@kylecheng3146/agent-ops 0.1.5 → 0.1.7

package/dist/runtime/src/install/doctor.js

@@ -6,8 +6,8 @@ import { resolveContainedPath } from "../fs/paths.js";
 import { validateConfig } from "../schema/validate.js";
 import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
 import { isOpencodeManagedPlugin } from "../adapters/opencode/config.js";
-import { harnessDescriptor } from "./harness.js";
-import { resolveProfiles } from "./profiles.js";
+import { harnessDescriptor, managedRules } from "./harness.js";
+import { resolveCapabilities, resolveProfiles } from "./profiles.js";
 import { inspectHarnessSurfaces, inspectHarnessRegistrations } from "./surface-inspection.js";
 const CONFIG_PATH = ".agent-ops/config.json";
 const MINIMUM_NODE_VERSION = [22, 14, 0];
@@ -124,25 +124,81 @@ async function checkConfig(root) {
 }
 async function checkArtifacts(root, manifest) {
     if (manifest === undefined) {
-        return check("artifacts", "FAIL", "Artifacts cannot be verified without a valid manifest.");
+        return {
+            check: check("artifacts", "FAIL", "Artifacts cannot be verified without a valid manifest."),
+            hashesByPath: new Map()
+        };
     }
     const failures = [];
+    const hashesByPath = new Map();
     for (const artifact of manifest.artifacts) {
         try {
             const content = await readContained(root, artifact.path);
-            if (sha256(content) !== artifact.hash ||
+            const hash = sha256(content);
+            if (hash !== artifact.hash ||
                 (artifact.id === "opencode-plugin" &&
                     !isOpencodeManagedPlugin(content.toString("utf8")))) {
                 failures.push(artifact.path);
             }
+            else {
+                hashesByPath.set(artifact.path, hash);
+            }
         }
         catch {
             failures.push(artifact.path);
         }
     }
-    return failures.length === 0
-        ? check("artifacts", "PASS", "All managed artifacts match their hashes.")
-        : check("artifacts", "FAIL", `Managed artifacts failed verification: ${failures.join(", ")}.`);
+    return {
+        check: failures.length === 0
+            ? check("artifacts", "PASS", "All managed artifacts match their hashes.")
+            : check("artifacts", "FAIL", `Managed artifacts failed verification: ${failures.join(", ")}.`),
+        hashesByPath
+    };
+}
+function checkArtifactStaleness(manifest, config, artifacts, toolkitVersion) {
+    if (manifest === undefined || config === undefined) {
+        return check("artifact-staleness", "UNKNOWN", "Managed artifact staleness cannot be assessed without a valid manifest and configuration.");
+    }
+    if (artifacts.check.status !== "PASS") {
+        return check("artifact-staleness", "UNKNOWN", "Managed artifact staleness cannot be assessed until artifact integrity passes.");
+    }
+    if (toolkitVersion === undefined) {
+        return check("artifact-staleness", "UNKNOWN", "Managed artifact staleness cannot be assessed without the running toolkit version.");
+    }
+    const expectedHashesByPath = new Map();
+    try {
+        const resolved = config.profiles.length === 0
+            ? { profiles: [], capabilities: [] }
+            : resolveCapabilities(config);
+        for (const id of manifest.harness) {
+            const descriptor = harnessDescriptor(id);
+            const path = `.agent-ops/${descriptor.control.instructionFile}`;
+            if (!expectedHashesByPath.has(path)) {
+                expectedHashesByPath.set(path, sha256(managedRules(descriptor, {
+                    scope: manifest.scope,
+                    profiles: resolved.profiles,
+                    capabilities: resolved.capabilities,
+                    toolkitVersion
+                })));
+            }
+        }
+    }
+    catch {
+        return check("artifact-staleness", "UNKNOWN", "Managed artifact staleness could not be assessed safely.");
+    }
+    const stalePaths = [];
+    for (const [path, expectedHash] of expectedHashesByPath) {
+        const actualHash = artifacts.hashesByPath.get(path);
+        if (actualHash === undefined) {
+            return check("artifact-staleness", "UNKNOWN", "Managed artifact staleness could not be assessed safely.");
+        }
+        if (actualHash !== expectedHash) {
+            stalePaths.push(path);
+        }
+    }
+    return stalePaths.length === 0
+        ? check("artifact-staleness", "PASS", "Managed artifacts match the current toolkit and configuration.")
+        : check("artifact-staleness", "DEGRADED", `Managed artifacts need update: ${stalePaths.join(", ")}; run agent-ops update.`, "UPDATE_REQUIRED");
 }
 async function checkMarkers(root, manifest) {
     if (manifest === undefined) {
@@ -282,22 +338,65 @@ async function checkRegistrationDrift(root, manifest, config) {
         return check("registration-drift", "UNKNOWN", "Hook registration drift could not be assessed safely.");
     }
 }
+/**
+ * Guidance lives in `message` rather than a `remediation` field: as of this
+ * check, `remediation` does not exist on DoctorCheck. Because target
+ * authentication failures surface as one unexplained review failure — the
+ * chain deliberately does not sniff stderr for "not logged in" — this text is
+ * the operator's only route out, so it names the exact command.
+ */
+async function checkReviewTargets(config, probe, checkAuth) {
+    const targets = config?.reviewRoles?.find((role) => role.role === "independent-review")?.targets ?? [];
+    if (targets.length === 0) {
+        return check("review-targets", "PASS", "External review disabled. Re-run agent-ops init to enable.");
+    }
+    if (probe === undefined) {
+        return check("review-targets", "PASS", `External review targets: ${targets.join(", ")}. ` +
+            "Login state unverified; run: agent-ops doctor --check-auth");
+    }
+    for (const target of targets) {
+        const result = await probe(target, checkAuth);
+        if (result === "missing-executable") {
+            return check("review-targets", "FAIL", `${target} not found. Install it, or remove "${target}" from ` +
+                "reviewRoles[].targets.", "UPDATE_REQUIRED");
+        }
+        if (result === "ineligible") {
+            return check("review-targets", "FAIL", `${target} has no read-only mode and cannot review. Remove ` +
+                `"${target}" from reviewRoles[].targets.`, "UPDATE_REQUIRED");
+        }
+        if (result === "timeout") {
+            return check("review-targets", "FAIL", `${target} did not answer in time. Re-run: ` +
+                "agent-ops doctor --check-auth", "UPDATE_REQUIRED");
+        }
+        if (checkAuth && result !== "ok") {
+            return check("review-targets", "FAIL", `${target} is installed but not authenticated, or it rejected the ` +
+                `call. Run: ${target} login`, "UPDATE_REQUIRED");
+        }
+    }
+    return check("review-targets", "PASS", checkAuth
+        ? `External review targets authenticated: ${targets.join(", ")}.`
+        : `External review targets: ${targets.join(", ")}. ` +
+            "Login state unverified; run: agent-ops doctor --check-auth");
+}
 export async function doctorInstallation(options) {
     const manifest = await checkManifest(options.root);
     const config = await checkConfig(options.root);
+    const artifacts = await checkArtifacts(options.root, manifest.manifest);
     const surfaceInventory = await checkSurfaceInventory(options.root, manifest.manifest, config.config);
     const checks = [
         checkNodeVersion(options.nodeVersion ?? process.versions.node),
         manifest.check,
         config.check,
-        await checkArtifacts(options.root, manifest.manifest),
+        artifacts.check,
+        checkArtifactStaleness(manifest.manifest, config.config, artifacts, options.toolkitVersion),
         await checkMarkers(options.root, manifest.manifest),
         surfaceInventory.check,
         await checkRegistrationDrift(options.root, manifest.manifest, config.config),
         await checkProbe("hook-registration", options.probes?.hookRegistration),
         checkLifecycleSummary(manifest.manifest, config.config),
         await checkProbe("repository-trust", options.probes?.repositoryTrust),
-        await checkProbe("smoke-availability", options.probes?.smokeAvailability)
+        await checkProbe("smoke-availability", options.probes?.smokeAvailability),
+        await checkReviewTargets(config.config, options.probes?.reviewTarget, options.checkReviewTargetAuth === true)
     ];
     return {
         checks,

package/dist/runtime/src/install/harness.js

@@ -1,4 +1,4 @@
-import { buildClaudeHookSettings, mergeClaudeSettings, stripClaudeManagedHooks } from "../adapters/claude/config.js";
+import { buildClaudeHookSettings, isClaudeManagedHandler, mergeClaudeSettings, stripClaudeManagedHooks } from "../adapters/claude/config.js";
 import { CLAUDE_CAPABILITY_REGISTRATIONS } from "../adapters/claude/events.js";
 import { normalizeClaudeHookInput } from "../adapters/claude/input.js";
 import { claudeHookOutput } from "../adapters/claude/output.js";
@@ -20,7 +20,6 @@ export const HARNESS_IDS = [
     "claude",
     "opencode"
 ];
-const CLAUDE_HOOK_MARKER = "--managed-by=agent-ops";
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -60,12 +59,13 @@ function jsonHookRegistered(control, source, capabilities) {
                 group.hooks.some(control.isManagedHandler)));
     });
 }
-function runtimeFailureResult(capability, registrations) {
+function runtimeFailureResult(capability, registrations, remedy) {
     const runtimeFailure = registrations.find((registration) => registration.capability === capability)?.runtimeFailure;
     return {
         action: runtimeFailure === "fail-closed" ? "block" : "continue",
         status: "UNKNOWN",
-        code: `${capability.replaceAll("-", "_").toUpperCase()}_UNAVAILABLE`
+        code: `${capability.replaceAll("-", "_").toUpperCase()}_UNAVAILABLE`,
+        ...(remedy === undefined ? {} : { remedy })
     };
 }
 function createJsonDescriptor(options) {
@@ -89,7 +89,7 @@ function createJsonDescriptor(options) {
         runtime: {
             normalizeInput: options.normalizeInput,
             formatOutput: options.formatOutput,
-            formatRuntimeFailure: (event, capability) => options.formatOutput(event, runtimeFailureResult(capability, options.registrations))
+            formatRuntimeFailure: (event, capability, remedy) => options.formatOutput(event, runtimeFailureResult(capability, options.registrations, remedy))
         }
     };
 }
@@ -136,9 +136,7 @@ const DESCRIPTORS = {
         buildHooks: (capabilities, runtimePath) => buildClaudeHookSettings(capabilities, runtimePath),
         mergeHooks: (existing, managed) => mergeClaudeSettings(existing, managed),
         stripHooks: (existing) => stripClaudeManagedHooks(existing),
-        isManagedHandler: (handler) => isRecord(handler) &&
-            Array.isArray(handler.args) &&
-            handler.args.includes(CLAUDE_HOOK_MARKER),
+        isManagedHandler: isClaudeManagedHandler,
         registrations: CLAUDE_CAPABILITY_REGISTRATIONS,
         normalizeInput: normalizeClaudeHookInput,
         formatOutput: (event, result) => claudeHookOutput(event, result)
@@ -158,7 +156,7 @@ const DESCRIPTORS = {
         runtime: {
             normalizeInput: normalizeOpencodeHookInput,
             formatOutput: (event, result) => opencodeHookOutput(event, result),
-            formatRuntimeFailure: (event, capability) => opencodeHookOutput(event, runtimeFailureResult(capability, OPENCODE_CAPABILITY_REGISTRATIONS))
+            formatRuntimeFailure: (event, capability, remedy) => opencodeHookOutput(event, runtimeFailureResult(capability, OPENCODE_CAPABILITY_REGISTRATIONS, remedy))
         }
     }
 };
@@ -229,7 +227,7 @@ export function resolveHarnessSelection(value) {
 }
 export const COMMON_AGENTS_BLOCK = DESCRIPTORS.codex.control.routing.desired;
 export const COMMON_CLAUDE_BLOCK = DESCRIPTORS.claude.control.routing.desired;
-function managedRules(descriptor, context) {
+export function managedRules(descriptor, context) {
     const lines = [
         "# Loop Engineering",
         "",

package/dist/runtime/src/install/ownership.js

@@ -2,9 +2,10 @@ import { applyManagedBlock, managedBlockMarkers } from "../fs/managed-block.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { harnessDescriptor, harnessHookPath, routingBlockId, selectHarnessHookSurface, rulesArtifactId } from "./harness.js";
 import { isOpencodePluginPath } from "../adapters/opencode/config.js";
+import { LOOP_MARKER_ID, LOOP_MARKER_VERSION, loopIgnoreContent, loopLauncherArtifactId, loopLauncherPath, selectedLoopHarnesses } from "./codex-loop.js";
 function expectedMarker(manifest, id, markerId) {
     const descriptor = harnessDescriptor(id);
-    const markers = managedBlockMarkers(markerId, 1);
+    const markers = managedBlockMarkers(markerId, 1, "html");
     return {
         id: markerId,
         path: manifest.scope === "project"
@@ -12,10 +13,23 @@ function expectedMarker(manifest, id, markerId) {
             : `.${id}/${descriptor.control.instructionFile}`,
         startMarker: markers.start,
         endMarker: markers.end,
+        markerStyle: "html",
         content: descriptor.control.routing.desired,
         legacyContent: descriptor.control.routing.legacy
     };
 }
+function expectedLoopMarker(manifest) {
+    const markers = managedBlockMarkers(LOOP_MARKER_ID, LOOP_MARKER_VERSION, "hash");
+    return {
+        id: LOOP_MARKER_ID,
+        path: ".gitignore",
+        startMarker: markers.start,
+        endMarker: markers.end,
+        markerStyle: "hash",
+        content: loopIgnoreContent(manifest.harness),
+        legacyContent: []
+    };
+}
 function pathKey(path) {
     return path.toLowerCase();
 }
@@ -64,6 +78,14 @@ export function assertSupportedManifestOwnership(manifest, root) {
     ]);
     const expectedMarkers = new Map();
     const expectedMarkerPaths = new Set();
+    const loopHarnesses = selectedLoopHarnesses(harnesses);
+    const hasLoopArtifacts = manifest.artifacts.some(({ id }) => loopHarnesses.some((harness) => id === loopLauncherArtifactId(harness)));
+    const hasLoopMarker = manifest.markers.some(({ id }) => id === LOOP_MARKER_ID);
+    const hasLoop = hasLoopArtifacts || hasLoopMarker;
+    if (hasLoop &&
+        (manifest.scope !== "project" || loopHarnesses.length === 0)) {
+        throw manifestOwnershipError();
+    }
     const recordedOpencodePluginPath = manifest.artifacts.find(({ id }) => id === "opencode-plugin")?.path;
     if (recordedOpencodePluginPath !== undefined &&
         (!harnesses.includes("opencode") ||
@@ -110,6 +132,18 @@ export function assertSupportedManifestOwnership(manifest, root) {
             });
         }
     }
+    if (hasLoop) {
+        for (const harness of loopHarnesses) {
+            const path = loopLauncherPath(harness);
+            expectedArtifactPaths.set(pathKey(path), {
+                path,
+                ids: new Set([loopLauncherArtifactId(harness)])
+            });
+            requiredArtifactPaths.add(pathKey(path));
+        }
+        expectedMarkerPaths.add(pathKey(".gitignore"));
+        expectedMarkers.set(LOOP_MARKER_ID, expectedLoopMarker(manifest));
+    }
     const opencodePluginPath = harnesses.includes("opencode")
         ? recordedOpencodePluginPath ??
             harnessHookPath("opencode", manifest.scope, root)
@@ -170,7 +204,8 @@ export function assertExpectedManagedBlock(source, marker, expected) {
         const expectedBlock = applyManagedBlock("", {
             id: expected.id,
             version: 1,
-            content
+            content,
+            markerStyle: expected.markerStyle
         }).replace(/\n$/u, "");
         if (currentBlock === expectedBlock) {
             return kind;

package/dist/runtime/src/install/plan.js

@@ -7,6 +7,7 @@ import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { validateConfig } from "../schema/validate.js";
 import { planHarnessContributions, harnessDescriptor, selectHarnessHookSurface } from "./harness.js";
 import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
+import { codexHooksExplicitlyDisabled, loopLauncherArtifactId, loopSeeds, planLoopContribution, selectedLoopHarnesses } from "./codex-loop.js";
 import { isOpencodeManagedPlugin } from "../adapters/opencode/config.js";
 import { planHookRegistration, planHookRemoval } from "./hooks.js";
 import { resolveCapabilities, resolveProfiles } from "./profiles.js";
@@ -39,7 +40,12 @@ async function readCurrentFile(root, path) {
         throw error;
     }
 }
-function formatConfig(profiles, existing) {
+function formatConfig(profiles, existing, reviewTargets = []) {
+    // Absent reviewRoles means external review is disabled; an empty selection
+    // must therefore omit the field rather than write an empty array.
+    const reviewRoles = reviewTargets.length > 0
+        ? [{ role: "independent-review", targets: [...reviewTargets] }]
+        : existing?.reviewRoles;
     return `${JSON.stringify({
         schemaVersion: CONFIG_SCHEMA_VERSION,
         profiles,
@@ -50,10 +56,11 @@ function formatConfig(profiles, existing) {
             }
         },
         pathMappings: existing?.pathMappings ?? [],
-        securityExceptions: existing?.securityExceptions ?? []
+        securityExceptions: existing?.securityExceptions ?? [],
+        ...(reviewRoles === undefined ? {} : { reviewRoles })
     }, null, 2)}\n`;
 }
-async function planConfig(root, profiles, existingManifest, suppliedConfig) {
+async function planConfig(root, profiles, existingManifest, suppliedConfig, reviewTargets = []) {
     const current = await readCurrentFile(root, CONFIG_PATH);
     const owned = findOwnedArtifact(existingManifest, CONFIG_PATH);
     if (current !== null && owned === undefined) {
@@ -85,7 +92,7 @@ async function planConfig(root, profiles, existingManifest, suppliedConfig) {
         }
         existingConfig = result.value;
     }
-    const content = formatConfig(profiles, existingConfig);
+    const content = formatConfig(profiles, existingConfig, reviewTargets);
     return {
         operation: {
             kind: "write",
@@ -116,7 +123,7 @@ function assertUniqueContributions(artifacts, blocks) {
     }
     const markerBoundaries = new Set();
     for (const block of blocks) {
-        const markers = managedBlockMarkers(block.id, block.version);
+        const markers = managedBlockMarkers(block.id, block.version, block.markerStyle);
         const key = pathKey(block.path);
         if (ids.has(block.id) ||
             artifactPaths.has(key) ||
@@ -198,9 +205,53 @@ async function planArtifactRemoval(root, artifact) {
         expectedHash: current.hash
     };
 }
+async function planCreateOnceSeeds(root, seeds) {
+    const operations = [];
+    for (const seed of seeds) {
+        const current = await readCurrentFile(root, seed.path);
+        if (current === null) {
+            operations.push({
+                kind: "write",
+                path: seed.path,
+                content: seed.content,
+                expectedHash: null
+            });
+        }
+    }
+    return operations;
+}
+/**
+ * User-owned seed files belong to the first loop install for each harness.
+ * An existing loop launcher is the durable installation record: it prevents an
+ * update from recreating a file a user intentionally removed, while still
+ * allowing loop to be enabled later or for a newly added harness.
+ */
+function loopHarnessesNeedingSeeds(harnesses, existingManifest) {
+    const existingArtifactIds = new Set(existingManifest?.artifacts.map(({ id }) => id) ?? []);
+    return selectedLoopHarnesses(harnesses).filter((harness) => !existingArtifactIds.has(loopLauncherArtifactId(harness)));
+}
 function markerKey(path, id) {
     return `${pathKey(path)}\0${id}`;
 }
+function assertLoopProfileSupport(scope, harness, capabilities) {
+    if (!capabilities.includes("project-loop")) {
+        return;
+    }
+    if (scope !== "project" ||
+        !harness.some((id) => id === "codex" || id === "claude")) {
+        throw new AgentOpsError("LOOP_PROFILE_UNSUPPORTED", "The loop profile requires project scope and the Codex or Claude harness.");
+    }
+}
+async function assertCodexLoopConfiguration(root, harness, capabilities) {
+    if (!capabilities.includes("project-loop") ||
+        !harness.includes("codex")) {
+        return;
+    }
+    const config = await readCurrentFile(root, ".codex/config.toml");
+    if (config !== null && codexHooksExplicitlyDisabled(config.content)) {
+        throw new AgentOpsError("CODEX_LOOP_HOOKS_DISABLED", "Codex loop installation requires [features] hooks = true; the existing .codex/config.toml explicitly disables hooks.");
+    }
+}
 async function planBlocks(root, blocks, removals = [], expectedMarkers = new Map()) {
     const grouped = new Map();
     for (const block of blocks) {
@@ -238,7 +289,7 @@ async function planBlocks(root, blocks, removals = [], expectedMarkers = new Map
                 throw new AgentOpsError("MANIFEST_OWNERSHIP_INVALID", "The manifest contains an unsupported managed block.");
             }
             assertExpectedManagedBlock(content, marker, expected);
-            content = removeManagedBlock(content, marker.id);
+            content = removeManagedBlock(content, marker.id, expected.markerStyle);
         }
         for (const block of pathBlocks) {
             content = applyManagedBlock(content, block);
@@ -260,7 +311,7 @@ async function planBlocks(root, blocks, removals = [], expectedMarkers = new Map
             });
         }
         for (const block of pathBlocks) {
-            const markers = managedBlockMarkers(block.id, block.version);
+            const markers = managedBlockMarkers(block.id, block.version, block.markerStyle);
             records.push({
                 id: block.id,
                 path,
@@ -282,6 +333,8 @@ export async function createInstallPlan(options) {
     const resolved = options.existingConfig === undefined
         ? resolveProfiles(options.profiles)
         : resolveCapabilities(options.existingConfig.value);
+    assertLoopProfileSupport(options.scope, options.harness, resolved.capabilities);
+    await assertCodexLoopConfiguration(options.root, options.harness, resolved.capabilities);
     const existing = await readExistingManifest(options.root);
     assertCompatibleManifest(existing?.manifest ?? null, options.scope, options.harness, options.allowHarnessChange === true);
     const existingOpencodePluginPath = existing?.manifest.artifacts.find(({ id }) => id === "opencode-plugin")?.path;
@@ -300,7 +353,7 @@ export async function createInstallPlan(options) {
         explicitHookTargets.size > 0) {
         throw new AgentOpsError("HOOK_TARGET_REQUIRES_RUNTIME", "An explicit hook target requires a hook runtime path.");
     }
-    const contribution = await planHarnessContributions(options.harness, {
+    const baseContribution = await planHarnessContributions(options.harness, {
         root: options.root,
         scope: options.scope,
         profiles: resolved.profiles,
@@ -315,6 +368,21 @@ export async function createInstallPlan(options) {
             ? {}
             : { opencodePluginPath: existingOpencodePluginPath })
     }, options.adapters);
+    const loopContribution = planLoopContribution({
+        scope: options.scope,
+        harnesses: options.harness,
+        capabilities: resolved.capabilities,
+        ...(options.hookRuntimePath === undefined
+            ? {}
+            : { hookRuntimePath: options.hookRuntimePath })
+    });
+    const contribution = {
+        artifacts: [
+            ...baseContribution.artifacts,
+            ...loopContribution.artifacts
+        ],
+        blocks: [...baseContribution.blocks, ...loopContribution.blocks]
+    };
     assertUniqueContributions(contribution.artifacts, contribution.blocks);
     const reconcileExisting = existing !== null;
     const expectedExistingMarkers = reconcileExisting
@@ -351,7 +419,7 @@ export async function createInstallPlan(options) {
         : [];
     const operations = [];
     const artifacts = [];
-    const config = await planConfig(options.root, resolved.profiles, existing?.manifest ?? null, options.existingConfig);
+    const config = await planConfig(options.root, resolved.profiles, existing?.manifest ?? null, options.existingConfig, options.reviewTargets ?? []);
     operations.push(config.operation);
     artifacts.push(config.record);
     for (const artifact of contribution.artifacts) {
@@ -359,6 +427,10 @@ export async function createInstallPlan(options) {
         operations.push(planned.operation);
         artifacts.push(planned.record);
     }
+    if (resolved.capabilities.includes("project-loop")) {
+        const seedHarnesses = loopHarnessesNeedingSeeds(options.harness, existing?.manifest ?? null);
+        operations.push(...await planCreateOnceSeeds(options.root, loopSeeds(seedHarnesses)));
+    }
     artifacts.push(...preservedArtifacts);
     for (const artifact of artifactsToRemove) {
         operations.push(await planArtifactRemoval(options.root, artifact));

package/dist/runtime/src/install/profiles.js

@@ -1,16 +1,18 @@
 import { AgentOpsError } from "../fs/paths.js";
-const PROFILE_ORDER = ["core", "advisory", "guardrails"];
+const PROFILE_ORDER = ["core", "advisory", "guardrails", "loop"];
 export const PROFILE_CAPABILITIES = {
     core: ["rules", "task", "verify", "review"],
     advisory: ["lifecycle-summary", "local-log"],
-    guardrails: ["command-policy"]
+    guardrails: ["command-policy"],
+    loop: ["project-loop"]
 };
 export function resolveProfiles(inputProfiles) {
     if (inputProfiles.length === 0) {
         throw new AgentOpsError("PROFILE_REQUIRED", "At least one installation profile is required.");
     }
     const selectedProfiles = new Set(inputProfiles);
-    if (selectedProfiles.has("guardrails")) {
+    if (selectedProfiles.has("guardrails") ||
+        selectedProfiles.has("loop")) {
         selectedProfiles.add("core");
     }
     const profiles = PROFILE_ORDER.filter((profile) => selectedProfiles.has(profile));

package/dist/runtime/src/install/uninstall.js

@@ -86,7 +86,7 @@ async function planMarkerFiles(root, markers, expectedMarkers) {
             }
             assertExpectedManagedBlock(content, marker, expected);
             try {
-                content = removeManagedBlock(content, marker.id);
+                content = removeManagedBlock(content, marker.id, expected.markerStyle);
             }
             catch (error) {
                 throw new AgentOpsError("MANAGED_BLOCK_CHANGED", `Managed block cannot be removed safely: ${path}`, { cause: error });

package/dist/runtime/src/install/update.js

@@ -9,6 +9,7 @@ import { createInstallPlan } from "./plan.js";
 const PACKAGE_NAME = "@kylecheng3146/agent-ops";
 const CONFIG_PATH = ".agent-ops/config.json";
 const MAX_UPDATE_CONFIG_BYTES = 1024 * 1024;
+const TOOLKIT_VERSION_PATTERN = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 async function readBoundedConfig(root) {
     const resolvedPath = await resolveContainedPath(root, CONFIG_PATH);
     const before = await lstat(resolvedPath, { bigint: true });
@@ -82,6 +83,9 @@ export async function createUpdatePlan(options) {
     if (targetVersion === undefined) {
         throw new AgentOpsError("UPDATE_TARGET_REQUIRED", "Update requires a target version or an explicit registry client.");
     }
+    if (!TOOLKIT_VERSION_PATTERN.test(targetVersion)) {
+        throw new AgentOpsError("INVALID_TOOLKIT_VERSION", "Toolkit version must be a valid semantic version.");
+    }
     const report = await doctorInstallation({ root: options.root });
     for (const id of [
         "node-version",
@@ -108,7 +112,7 @@ export async function createUpdatePlan(options) {
         harness: options.harness ?? report.manifest.harness,
         profiles: configPreview.migrated.profiles,
         adapters: options.adapters,
-        toolkitVersion: targetVersion,
+        toolkitVersion: options.toolkitVersion ?? targetVersion,
         allowHarnessChange: true,
         ...(options.hookRuntimePath === undefined
             ? {}

package/dist/runtime/src/logging/local-log.js

@@ -83,6 +83,31 @@ function sanitizeEvent(value) {
             result: value.result
         };
     }
+    if (value.type === "loop-event") {
+        if (!hasExactKeys(value, ["code", "event", "outcome", "type"]) ||
+            typeof value.code !== "string" ||
+            !ID_PATTERN.test(value.code) ||
+            ![
+                "permission-request",
+                "post-compact",
+                "post-tool-use",
+                "pre-compact",
+                "pre-tool-use",
+                "session-start",
+                "subagent-start",
+                "subagent-stop",
+                "user-prompt-submit"
+            ].includes(String(value.event)) ||
+            !["allowed", "blocked", "observed"].includes(String(value.outcome))) {
+            return invalidEvent();
+        }
+        return {
+            type: "loop-event",
+            event: value.event,
+            outcome: value.outcome,
+            code: value.code
+        };
+    }
     return invalidEvent();
 }
 function serialize(stored) {